AI Security for SRE & Platform Engineers: Production Threats to Know

AI security is partly an infrastructure problem

Models can be manipulated through inputs, but production impact depends on what the surrounding application allows the model to reach. SRE and platform teams influence identity, network paths, tool permissions, secrets, observability, quotas and isolation — all major parts of the security boundary.

Prompt injection

Prompt Injection tries to alter model behavior through crafted instructions. Indirect Prompt Injection is especially important when an agent or RAG system consumes external content such as documents, websites or tickets.

Tool and agent risk

When a model can call tools, failures can become actions. Limit Excessive Agency with least privilege, allowlists, validation, explicit approval for high-impact actions, idempotency and bounded loops. Treat tool descriptions and MCP integrations as security-sensitive configuration.

RAG and data-plane risk

RAG Poisoning can influence answers by planting malicious or misleading content in knowledge sources. Preserve source identity and authorization, and do not collapse security boundaries simply because content is being transformed into embeddings.

Availability and cost abuse

Denial of Wallet targets spend rather than only CPU. Long prompts, expensive models, recursive agents and repeated tool calls can amplify costs. Rate limits, token budgets, concurrency limits and cost alerts are reliability controls as well as financial controls.

The SRE security checklist

• Separate model identity from user identity and preserve authorization context.
• Give tools minimum required privileges.
• Do not expose secrets in prompts, traces or retrieved content.
• Bound tokens, time, tool calls and agent iterations.
• Audit external tool/server configuration.
• Trace security-relevant decisions and high-impact actions.